GHSA-4gp3-p7ph-x2jr
OS Command Injection in devcert-sanscache
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | devcert-sanscache | < 0.4.7 | 0.4.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.
References
External links from the advisory. They lead to third-party sites.